The European Accessibility Act Is Live. Is Your Site a Liability?

This is a market-access law, not a lawsuit lottery

For a decade, US companies have treated web accessibility as a litigation cost, a templated demand letter you settle, a number you budget for. The European Accessibility Act (EAA) breaks that mental model. It is product-safety-style regulation. The Directive (EU) 2019/882 was transposed into national law across the bloc, and as of 28 June 2025 covered products and services placed on the EU market must be accessible, or they can be withdrawn from sale.

That distinction matters. A US plaintiff wants a settlement. An EU market-surveillance authority wants conformity, and if it does not get it, the remedy is escalating: a corrective-action order, a fine, and ultimately a prohibition on selling the product or service in that member state. As Pivotal Accessibility documented in its post-deadline enforcement review, the first months of enforcement leaned on complaint-driven investigations and corrective orders rather than headline fines, but the legal machinery to escalate is fully live.

What is actually covered

The EAA is broader than "websites." It covers a defined list of products and services that the EU considers central to participation in modern economic life. The product side includes consumer computing hardware, payment terminals, self-service kiosks (ATMs, ticketing, check-in machines), e-readers, and smartphones. The service side is where most digital teams get caught:

• E-commerce, any consumer-facing online store selling goods or services.
• Banking and financial services, consumer banking, payment services, investment platforms.
• Electronic communications, telecom services and their interfaces.
• Transport, websites, apps, e-tickets, and real-time travel information for air, bus, rail, and waterborne passenger services.
• Audiovisual media access, the access components of streaming and media services.
• E-books and dedicated reading software.

There is a microenterprise exemption for service providers with fewer than 10 employees and under €2 million annual turnover, but it does not extend to product manufacturers, and "microenterprise" is a low ceiling that most companies building a covered service blow past quickly. Per Acquia's EAA and EN 301 549 guide, the safe planning assumption for any consumer-facing digital business with EU revenue is: you are in scope until proven otherwise.

EN 301 549 is the technical bar, and it is WCAG you already know

The EAA itself describes functional accessibility requirements in plain language. The technical standard that operationalizes them is EN 301 549, the European harmonized standard for ICT accessibility. Conformance with EN 301 549 gives you a presumption of conformity with the EAA, the legal equivalent of a known-good checklist a regulator will accept.

Here is the part that should change how you prioritize: EN 301 549's web requirements are built directly on the WCAG 2.1 Level AA success criteria. The same Web Content Accessibility Guidelines that drive US ADA litigation are the spine of the European standard. There is no separate European rulebook to learn for the web layer. If you fix your site to WCAG 2.1 AA, you are most of the way to EN 301 549 conformity, and you have simultaneously hardened yourself against US suits and the EAA.

The penalties are real, and they vary by border

The EAA does not set a single EU-wide fine. It instructs each member state to adopt penalties that are "effective, proportionate, and dissuasive, " then leaves the numbers to national law. The result is a patchwork where the same defect carries wildly different exposure depending on which market you serve. From the cross-country breakdowns compiled by Web Accessibility Checker's EAA penalty tracker and Auditsu's fines analysis:

• Germany, the Bundesnetzagentur (Federal Network Agency) can impose fines up to €100,000 per individual violation, and crucially can order a product or service withdrawn from the market.
• Spain, a tiered regime: minor infractions €301-€30,000, serious €30,001-€90,000, and very serious infractions up to €1,000,000.
• Ireland, the only confirmed member state attaching criminal liability, with maximum penalties of €60,000 in fines and/or up to 18 months imprisonment.
• France, enforcement split across ARCOM and the DGCCRF, with administrative fines and corrective-order powers.
• Italy, AGID and the Ministry of Enterprises share oversight, with administrative sanctions.

Because penalties are per-jurisdiction, a single inaccessible checkout flow sold across the EU is not one exposure, it is up to 27 separate exposures, each governed by a different national authority with its own ceiling. The multi-market seller faces a multiplied risk that the US single-forum litigant never does.

What enforcement actually looks like in practice

EAA enforcement is largely complaint-driven and surveillance-driven. A consumer, a disability advocacy organization, or a competitor files a complaint with the national market-surveillance authority. The authority investigates, typically by testing the product or service against EN 301 549. If it finds non-conformity, it issues a corrective-action order with a deadline. Miss the deadline and the fine and withdrawal powers come into play.

The practical implication is that you do not get to discover your gaps in a courtroom 60 days after a demand letter. You discover them when a regulator tests your live site against an automatable checklist, which means the rational move is to run that same checklist yourself, continuously, before anyone files a complaint. The defects regulators test for are the ones a WCAG scanner enumerates in seconds:

# Map an automated scan to EN 301 549 / WCAG 2.1 AA tags
# (axe-core ruleset, the same engine regulators' testers reach for)
import { AxePuppeteer } from '@axe-core/puppeteer';

const results = await new AxePuppeteer(page)
  .withTags(['wcag2a', 'wcag2aa', 'wcag21a', 'wcag21aa'])
  .analyze();

// EN 301 549 web clauses map onto these WCAG SCs.
// Bucket findings the way an enforcement tester would report them.
const buckets = { critical: [], serious: [], moderate: [], minor: [] };
for (const v of results.violations) {
  buckets[v.impact].push({ rule: v.id, sc: v.tags, count: v.nodes.length });
}

const evidence = {
  scanned_at: new Date().toISOString(),
  standard: 'EN 301 549 (WCAG 2.1 AA)',
  critical: buckets.critical.length,
  serious: buckets.serious.length,
};
console.log(JSON.stringify(evidence, null, 2));
// Keep this artifact: it is your conformity evidence trail.

That JSON artifact is not just a developer convenience. Under the EAA you are expected to be able to demonstrate conformity, a documented, dated, repeatable scan history is exactly the kind of evidence that turns a regulator's investigation from "prove you are compliant" into "here is the dated record."

Build the conformity gate into your pipeline

A once-a-year manual audit cannot keep a continuously deployed product conformant. A new marketing landing page, a refactored checkout component, a third-party booking widget, an A/B test variant, any of these can reintroduce a WCAG failure the day after your audit signs off. Accessibility regresses exactly like performance and security regress: silently, on every deploy, unless you gate it.

# CI gate: fail the build on new EN 301 549 / WCAG AA regressions
- name: Accessibility conformity gate
  run: |
    npx axe-ci --tags wcag2a, wcag2aa, wcag21aa \
      --exit-on critical, serious \
      --reporter json --output a11y-report.json
    node ./scripts/compare-baseline.js \
      --current a11y-report.json \
      --baseline ./a11y/baseline.json \
      --fail-on-new-violations
  # A deploy that adds a critical or serious WCAG failure
  # cannot reach an EU customer. That is the whole point.

The bottom line

The European Accessibility Act is live, it reaches across borders to any company selling into the EU, and it is enforced by regulators with the power to fine per violation and pull your product from the market. Its technical bar, EN 301 549, is WCAG 2.1 AA, the same standard that drives US accessibility litigation. That convergence is the opportunity: scan your site against WCAG 2.1 AA, remediate the critical and serious findings, gate every deploy so it cannot regress, and keep the dated scan history as conformity evidence. One disciplined program covers two continents of risk. The companies that treated June 2025 as a deadline are compliant. The ones that treated it as a someday-problem are now a complaint away from a corrective-action order.